Czech crypto exchange Coinmate faced an attack. Personal data of 123 thousand people leaked

Crypto exchange Coinmate, which has been operating in the Czech Republic since 2014, has admitted a serious security incident. On October 30, an unknown attacker gained access to part of its systems and downloaded personal data of over 120,000 users. According to the company, their cryptocurrencies or money were not accessed, but the leaked data could be used by fraudsters to carry out more sophisticated attacks.

Phone numbers, names, and addresses leaked

As Coinmate states in its announcement, the leak affects exactly 123,200 users. The extent varies for individuals depending on the data they provided to the exchange. The attacker primarily obtained first and last name, gender, date and place of birth, nationality, residential address, and phone number.

Máme nepříjemnou zprávu.

30.10. došlo k neoprávněnému přístupu a stažení části osobních údajů některých uživatelů. Přístup jsme neprodleně zablokovali.

Prostředky jsou v bezpečí. Hesla, údaje pro 2FA ani doklady totožnosti nebyly zasaženy. Omlouváme se.

Více:…

— Coinmate.io (@CoinmateBT) November 3, 2026

Conversely, according to Coinmate, the leaked data does not include email addresses, passwords, two-factor authentication data, API keys, identity documents, national identification numbers, bank account numbers, or cryptocurrency wallet addresses. The exchange also emphasized on network X that the attacker did not find out how many cryptocurrencies or funds anyone has in their account. According to the company, no one can log in, withdraw, or transfer funds using the leaked data. Trading and withdrawals function without restrictions, and nothing needs to be changed in the account settings.

Phishing attacks now pose the main risk

Today, the exchange sent an email to affected users with a precise list of the data involved in the leak. It also warns against so-called phishing – attackers may impersonate Coinmate employees and, thanks to the leaked data, may know your name, address, or date of birth, thus appearing trustworthy. They may contact you by phone, SMS, or letter.

Coinmate therefore reminds of several principles:

• The exchange will never ask you for your password, two-factor authentication code, or to transfer funds via phone, SMS, or email.
• It will never ask you for your recovery phrase (seed) anywhere, anytime.
• Anyone asking you to install a remote access application, such as AnyDesk or TeamViewer, is a fraudster.
• It is better to end a suspicious call and verify it with support at [email protected].
• Access your account via the manually entered address coinmate.io or the mobile application, not through links in messages.

The company also recommends having two-factor authentication enabled. According to them, the email about the incident does not contain any login link, so if you receive a message with such a prompt, do not respond to it in any way.

The Czech National Bank, the Office for Personal Data Protection, and the police are already aware of the incident

According to Coinmate, it blocked the attacker’s access immediately upon detection and removed the vulnerability. Subsequently, it reviewed all withdrawals, trades, and account changes and found no discrepancies. It reported the incident to the Czech National Bank and the Office for Personal Data Protection and filed a criminal complaint.

“Client funds were not at risk, and all services are functioning without restrictions. We blocked unauthorized access, removed the vulnerability, and reported the incident to the authorities. We apologize to all affected users,” stated Coinmate CEO Roman Valihrach.

The exchange is also preparing further changes. All access paths to the application will receive a second layer of verification, it has expanded automatic security tests to include newly identified types of vulnerabilities, and it is changing the company that performs security audits for it. It promised to publish a comprehensive report from the new audit.

Did you receive an email from Coinmate stating that you are affected by the leak?

Sources: Coinmate (1, 2)